@cloudgrid-io/mcp 0.21.5 → 0.21.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.5",
+  "version": "0.21.7",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -17,6 +17,7 @@
     "start:web": "node src/web.js",
     "smoke": "node test/smoke.mjs",
     "test:plug-wire": "node test/plug-wire.test.mjs",
+    "test:plug-grid-derive": "node test/plug-grid-derive.test.mjs",
     "test:session-log": "node test/session-logger.test.mjs",
     "test:error-reporting": "node test/error-reporting.test.mjs",
     "test:source": "node test/source-fetch.test.mjs",
@@ -66,15 +67,23 @@
     "test:pull-output-schema": "node test/pull-output-schema.test.mjs",
     "test:web-identity": "node --test test/web-identity.test.mjs",
     "test:web-auth-integration": "node --test test/web-auth-integration.test.mjs",
-    "test:web-restart-recovery": "node --test test/web-restart-recovery.test.mjs"
+    "test:web-restart-recovery": "node --test test/web-restart-recovery.test.mjs",
+    "test:web-capabilities-log": "node --test test/web-capabilities-log.test.mjs",
+    "test:internal-refs": "node --test test/no-internal-refs.test.mjs",
+    "test:login-app": "node test/login-app.test.mjs",
+    "build:login-widget": "node scripts/build-login-widget.mjs"
   },
   "dependencies": {
+    "@modelcontextprotocol/ext-apps": "^1.7.5",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "express": "^4.22.2",
     "fflate": "^0.8.3",
     "undici": "^8.10.0",
     "zod": "^3.23.0"
   },
+  "devDependencies": {
+    "esbuild": "^0.25.0"
+  },
   "license": "Apache-2.0",
   "homepage": "https://github.com/cloudgrid-io/mcp",
   "repository": {

package/src/tools/constants.js

@@ -60,6 +60,18 @@ export const LIVE_RESULT_URI = "ui://cloudgrid/live-result.html";
 export const GRID_PICKER_URI = "ui://cloudgrid/org-picker.html";
 export const LIVE_RESULT_HTML = readFileSync(new URL("../widgets/live-result.html", import.meta.url), "utf-8");
 export const GRID_PICKER_HTML = readFileSync(new URL("../widgets/org-picker.html", import.meta.url), "utf-8");
+
+// ── grid_login MCP App (SEP-1865, Claude web) ────────────────────────────────
+// A SECOND, independent UI mechanism from the ChatGPT Apps-SDK widgets above.
+// It is NOT gated behind MCP_APPS_WIDGETS: that flag controls only the
+// openai/outputTemplate key ChatGPT reads, and it must stay exactly as it is.
+// The login card binds via _meta.ui.resourceUri (the SEP-1865 key Claude reads),
+// which ChatGPT ignores — so shipping it does not touch the ChatGPT path. A
+// client without the UI extension ignores _meta.ui and still gets the text-first
+// sign-in URL. The HTML is the self-contained bundle from
+// scripts/build-login-widget.mjs (App class + card inlined; deny-by-default CSP).
+export const GRID_LOGIN_APP_URI = "ui://grid-login/mcp-app.html";
+export const GRID_LOGIN_APP_HTML = readFileSync(new URL("../widgets/grid-login.html", import.meta.url), "utf-8");
 export const WIDGET_CSP = {
   connectDomains: ["https://*.cloudgrid.io"],
   resourceDomains: ["https://*.cloudgrid.io"],

package/src/tools/deploy.js

@@ -848,10 +848,8 @@ export async function runPull(ctx, { claim_token, claim_url, entity_id, grid } =
     let msg = data?.error?.message || data?.message || raw || `HTTP ${res.status}`;
     // The API's "Set the X-CloudGrid-Grid header" error is unactionable for an
     // MCP client (no client can set HTTP headers on a tool call). Rewrite it to
-    // name the tool parameter the caller CAN set (#247).
-    if (res.status === 400 && /X-CloudGrid-Grid/i.test(msg)) {
-      msg = "You belong to more than one grid. Pass the `grid` parameter to specify which grid to use.";
-    }
+    // name the tool parameter the caller CAN set (#247; class-level since #296).
+    if (res.status === 400) msg = rewriteGridHeaderError(msg);
     throw new Error(`Pull failed (HTTP ${res.status}): ${msg}`);
   }
 
@@ -968,7 +966,10 @@ export async function runCollab(ctx, { entity_id, grid } = {}) {
     if (res.status === 400 && code === "NOT_A_RUNTIME") {
       throw new Error(data?.error?.message || `'${target}' is an Inspiration, not an app or agent — it has no collaborators. Fork it with grid_pickup instead.`);
     }
-    const msg = data?.error?.message || data?.message || raw || `HTTP ${res.status}`;
+    let msg = data?.error?.message || data?.message || raw || `HTTP ${res.status}`;
+    // Never surface the raw "Set the X-CloudGrid-Grid header" text — name the
+    // `grid` parameter instead (#296 class-level fix; see rewriteGridHeaderError).
+    if (res.status === 400) msg = rewriteGridHeaderError(msg);
     throw new Error(`Collab failed (HTTP ${res.status}): ${msg}`);
   }
 
@@ -1442,10 +1443,38 @@ export const REPORT_OFFER =
   "then call grid_report with the error + the failed request context. " +
   "Do NOT report without an explicit yes, and do NOT include the full conversation unless the user explicitly agrees.";
 
+// The API's "Set the X-CloudGrid-Grid header" 400 (code GRID_HEADER_REQUIRED) is
+// STRUCTURALLY unactionable for an MCP client: no client can set an HTTP header
+// on a tool call, so a model reading it starts guessing (observed live, #296).
+// Rewrite it to name the tool PARAMETER the caller CAN set. `param` is the grid-
+// carrying parameter on the calling tool (`grid` on plug/pull/collab/visibility;
+// `into_org_slug` on pickup). First added inline on the pull path for #247; this
+// is the class-level version applied at every authed write path.
+//
+// A message is a grid-header error when the code says so OR the text names the
+// header — matching both survives an API message reword. Anything else passes
+// through unchanged. The rewritten text never contains the words "header" or
+// "X-CloudGrid-Grid", nor the internal code.
+export function isGridHeaderError(code, msg) {
+  return code === "GRID_HEADER_REQUIRED" || /X-CloudGrid-Grid/i.test(msg || "");
+}
+export function rewriteGridHeaderError(msg, param = "grid") {
+  if (!isGridHeaderError(null, msg)) return msg;
+  return `You belong to more than one grid. Pass the \`${param}\` parameter to specify which grid to use.`;
+}
+
 // Map friendly plug error statuses to actionable messages (spec v2 §3.3).
 // Appends errorGuidance() for known codes; unknown codes pass through as the
 // bare `base` line, unchanged.
 function plugErrorMessage(status, code, msg, ctxFlags = {}) {
+  // A GRID_HEADER_REQUIRED (or any 400 naming the header) is unactionable —
+  // rewrite it to name the `grid` PARAMETER and DROP the internal code from the
+  // prefix (the code string itself contains "HEADER"). Class-level fix (#296);
+  // mirrors the pull-path rewrite (#247). Part A derives the grid on an edit so
+  // this normally never fires there; it still guards multi-grid CREATES.
+  if (status === 400 && isGridHeaderError(code, msg)) {
+    return `Plug failed (HTTP 400): ${rewriteGridHeaderError(msg)}`;
+  }
   const base = `Plug failed (HTTP ${status}${code ? ` ${code}` : ""}): ${msg}`;
   const guidance = errorGuidance({ status, code, ...ctxFlags });
   return guidance ? `${base} — ${guidance}` : base;
@@ -1528,6 +1557,7 @@ export async function runPlug(ctx, input, deps = {}) {
     target_entity_id,
     grid,
     slug,
+    url: targetUrl,
     hints,
     anon,
     owner_token,
@@ -1647,16 +1677,30 @@ export async function runPlug(ctx, input, deps = {}) {
     );
   }
 
-  // grid+slug re-plug handle (the pickup contract's `replug_handle`): when no
-  // explicit target_entity_id was given but a grid+slug pair is, resolve it to
-  // an existing entity_id and re-plug that in place. A slug that does NOT resolve
-  // to an existing entity → targetEntityId stays empty → this is a CREATE (no
-  // false-positive re-plug). target_entity_id remains the primary/documented
-  // handle. Best-effort resolve (pickup contract); never fetches the public URL.
+  // Re-plug handle resolution (the pickup contract's `replug_handle`): when no
+  // explicit target_entity_id was given, resolve one from an alternative target
+  // the caller DID name — a grid+slug pair, or a CloudGrid `url` — so an edge
+  // identified only by its public URL re-plugs the SAME entity in place instead
+  // of minting a new one. A target that does NOT resolve to an existing entity →
+  // targetEntityId stays empty → this is a CREATE (no false-positive re-plug).
+  // target_entity_id remains the primary/documented handle. Best-effort resolve
+  // (pickup contract); never fetches the public URL.
+  //
+  // #296: a `url` is only trusted as a re-plug target when its host is a real
+  // CloudGrid grid apex (gridFromCloudgridUrl != null) — a foreign or malformed
+  // host is NOT sent to the resolver, so an untrusted URL can never redirect a
+  // write to another entity. `pickupData` is reused below to header the write
+  // without a second round-trip.
   let targetEntityId = target_entity_id;
-  if ((typeof targetEntityId !== "string" || targetEntityId.length === 0) && grid && slug) {
-    const resolved = await resolveEntityViaPickup(ctx, { target: slug, grid });
-    if (resolved?.entity_id) targetEntityId = resolved.entity_id;
+  const urlGrid = gridFromCloudgridUrl(targetUrl);
+  let pickupData = null;
+  if (typeof targetEntityId !== "string" || targetEntityId.length === 0) {
+    if (grid && slug) {
+      pickupData = await resolveEntityViaPickup(ctx, { target: slug, grid });
+    } else if (urlGrid) {
+      pickupData = await resolveEntityViaPickup(ctx, { url: targetUrl, grid: urlGrid });
+    }
+    if (pickupData?.entity_id) targetEntityId = pickupData.entity_id;
   }
 
   const isEdit = typeof targetEntityId === "string" && targetEntityId.length > 0;
@@ -1742,7 +1786,27 @@ export async function runPlug(ctx, input, deps = {}) {
     // the caller's membership from this header and requires it to MATCH the
     // entity's grid, so pass `grid` here too when the target lives outside the
     // active grid.
+    // #296: an EDIT's destination is NOT ambiguous — the entity already lives in
+    // exactly one grid, and every way of naming that entity carries the grid.
+    // Resolve it in a deliberate order, cheapest reliable source first, so the
+    // write never depends on session state the API would otherwise reject for
+    // (GRID_HEADER_REQUIRED):
+    //   1. explicit `grid` param        — the caller said so.
+    //   2. active grid                   — session state, no network.
+    //   3. the URL host                  — FREE: the grid is the subdomain of a
+    //      CloudGrid `url` the user pasted; read it before any round-trip. A
+    //      foreign/malformed host yields null (gridFromCloudgridUrl) and we fall
+    //      through — never a silent redirect.
+    //   4. the target entity itself      — a pickup round-trip, only if 1–3 all
+    //      came up empty. Reuse a pickup already done above to resolve the id.
     orgSlug = grid || (await ctx.getActiveGrid());
+    if (!orgSlug) orgSlug = gridFromCloudgridUrl(targetUrl);
+    if (!orgSlug && isEdit) {
+      if (!pickupData && targetEntityId) {
+        pickupData = await resolveEntityViaPickup(ctx, { target: targetEntityId });
+      }
+      if (pickupData?.grid) orgSlug = pickupData.grid;
+    }
     // Grid-native header + X-CloudGrid-Org alias (same slug) during the soak.
     if (orgSlug) {
       headers["X-CloudGrid-Grid"] = orgSlug;
@@ -2134,7 +2198,7 @@ export async function runPlug(ctx, input, deps = {}) {
   return { text: lines.join("\n"), structured };
 }
 
-async function authedApiCall(ctx, { method, pathName, body, verb }) {
+async function authedApiCall(ctx, { method, pathName, body, verb, gridParam = "grid" }) {
   const token = await ctx.getToken();
   if (!token) {
     throw new Error(`${verb} requires sign-in. Run grid_login first.`);
@@ -2167,7 +2231,13 @@ async function authedApiCall(ctx, { method, pathName, body, verb }) {
   if (!res.ok) {
     const msg = data?.error?.message || data?.message || raw || `HTTP ${res.status}`;
     const codeStr = data?.error?.code || null;
-    const err = new Error(`${verb} failed (HTTP ${res.status}${codeStr ? ` ${codeStr}` : ""}): ${msg}`);
+    // A GRID_HEADER_REQUIRED is unactionable — name the grid-carrying parameter
+    // (into_org_slug for pickup) and drop the internal code from the prefix (it
+    // contains "HEADER"). #296 class-level fix; see rewriteGridHeaderError.
+    const errText = isGridHeaderError(codeStr, msg)
+      ? `${verb} failed (HTTP ${res.status}): ${rewriteGridHeaderError(msg, gridParam)}`
+      : `${verb} failed (HTTP ${res.status}${codeStr ? ` ${codeStr}` : ""}): ${msg}`;
+    const err = new Error(errText);
     // Expose the structured status/code so callers can branch (e.g. runPickup's
     // NOT_A_RUNTIME → inspiration-route fallback). Additive: existing callers
     // only read `.message`.
@@ -2194,6 +2264,9 @@ export async function runPickup(ctx, { id, into_org_slug, name, source_version_i
       ...(source_version_id ? { source_version_id } : {}),
     },
     verb: "Pickup",
+    // A fork's destination is chosen by the caller via into_org_slug, so a
+    // GRID_HEADER_REQUIRED must point there, not at a non-existent `grid` param.
+    gridParam: "into_org_slug",
   });
   const gridSlug = data?.grid_slug ?? data?.org?.slug ?? null;
   const lines = [
@@ -2430,8 +2503,11 @@ export async function runVisibility(ctx, { target, visibility, inside, outside,
     if (!canFallback) break;
   }
 
-  const msg = last?.data?.error?.message || last?.raw || `HTTP ${last?.res?.status}`;
+  let msg = last?.data?.error?.message || last?.raw || `HTTP ${last?.res?.status}`;
   const hint = last?.data?.error?.details?.[0]?.hint;
+  // Never surface the raw header text — name the `grid` parameter (grid_visibility
+  // accepts one via `org`, exposed to callers as the grid). #296 class-level fix.
+  if (last?.res?.status === 400) msg = rewriteGridHeaderError(msg);
   throw new Error(`Visibility change failed (HTTP ${last?.res?.status}): ${msg}${hint ? ` ${hint}` : ""}`);
 }
 
@@ -2636,6 +2712,42 @@ function isCloudgridHost(hostname) {
   return h === "cloudgrid.io" || h.endsWith(".cloudgrid.io");
 }
 
+// Derive the home grid slug from a CloudGrid URL (or a bare host). The grid is
+// the subdomain: `<grid>.cloudgrid.io/<slug>` (inspiration/path form) and
+// `<slug>--<grid>.cloudgrid.io` (runtime/flat form — grid is the label after
+// `--`), matching composePlugUrl's two serving shapes.
+//
+// SECURITY (#296): this derives a WRITE DESTINATION from user-supplied input, so
+// it is deliberately strict — it reuses `isCloudgridHost` (the single host check,
+// SSRF-shaped) rather than string-matching, and returns null for anything that is
+// not a trusted grid apex: a foreign or lookalike host, a malformed URL, the bare
+// apex `cloudgrid.io`, a deeper host (`a.b.cloudgrid.io`), or the anonymous
+// `guest` apex (never an authed write destination). A null result means "I could
+// not name the grid" → the caller falls through to today's behaviour and NEVER
+// silently redirects the write to a grid the user did not mean.
+export function gridFromCloudgridUrl(input) {
+  const raw = String(input ?? "").trim();
+  if (!raw) return null;
+  let parsed;
+  try {
+    // Accept a bare host (`shoobi.cloudgrid.io/x`) by supplying a scheme; a
+    // string that is already a URL keeps its own scheme.
+    parsed = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`);
+  } catch {
+    return null;
+  }
+  if (!isCloudgridHost(parsed.hostname)) return null;
+  const host = parsed.hostname.toLowerCase();
+  const labels = host.split(".");
+  // Exactly `<sub>.cloudgrid.io`. The apex (`cloudgrid.io`, 2 labels) and any
+  // deeper host (`a.b.cloudgrid.io`, 4+) name no single grid apex we trust.
+  if (labels.length !== 3) return null;
+  const sub = labels[0];
+  const grid = sub.includes("--") ? sub.split("--").pop() : sub;
+  if (!grid || grid === GUEST_ORG_SLUG) return null;
+  return grid;
+}
+
 // Shape an HTML string into the grid_get_app_source result (shared by the API-read
 // and the public-fetch paths). Caps the body at SOURCE_MAX_BYTES. `extra` carries
 // optional edition metadata resolved from the pickup contract (kind, single_html,
@@ -2785,10 +2897,10 @@ export async function runSource(ctx, { entity_id, url, grid, slug } = {}) {
   const resolvedUrl = parsed.toString();
   let eid = entity_id ?? (last && (!entity_id || last.entity_id === entity_id) ? last.entity_id : null);
 
-  // Derive the grid/slug hint from the inspiration path URL (`grid.cloudgrid.io/slug`).
-  const host = parsed.hostname;
-  const gridHint = grid ?? (host.endsWith(".cloudgrid.io") && !host.includes("--") && host.split(".").length === 3
-    ? host.split(".")[0] : null);
+  // Derive the grid/slug hint from the URL. gridFromCloudgridUrl is the single
+  // host→grid parser (it also handles the flat `<slug>--<grid>` form the old
+  // inline check missed); the slug is the first path segment.
+  const gridHint = grid ?? gridFromCloudgridUrl(resolvedUrl);
   const slugHint = slug ?? (parsed.pathname.replace(/^\/+/, "").split("/")[0] || null);
 
   // ── URL → entity_id (fresh chat, no session) via the pickup contract ──────

package/src/tools/register.js

@@ -3,6 +3,7 @@
 // Extracted verbatim from src/tools.js (refactor: split tools.js into modules).
 
 import { z } from "zod";
+import { registerAppResource, RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/server";
 import { newLoginCode, buildLoginUrl, pollStatusOnce, checkApiConnectivity, decodeJwt as decodeJwtAuth } from "../auth.js";
 import { PLAYBOOK, fetchCorpus, listWorkflows } from "../playbook.js";
 import {
@@ -12,6 +13,8 @@ import {
   LIVE_RESULT_HTML,
   GRID_PICKER_HTML,
   WIDGET_CSP,
+  GRID_LOGIN_APP_URI,
+  GRID_LOGIN_APP_HTML,
 } from "./constants.js";
 import { fail, okResult } from "./util.js";
 import { cliTool, tryOpenBrowser } from "./cli.js";
@@ -47,6 +50,33 @@ export function buildCreateProjectArgs({ kind, name, type, needs, dir, grid, org
   return args;
 }
 
+// ── Sign-in ask (#298) ──────────────────────────────────────────────────────
+// Until a rendered login card is possible (blocked on #297's answer + the
+// directory submission), this text IS the whole login experience on every
+// client, so it is written to be RELAYED nearly verbatim. The user-facing part
+// comes first — a short question, then the two evenly-weighted options (guest is
+// a real choice, not a fallback). The model-directed steps (which tool to call,
+// do not choose, wait) are quarantined in a trailing (assistant: …) line so the
+// model does not read internal directions aloud. §23 voice: plain, no emoji, no
+// exclamation; say "plug" and "grid". The sign-in URL itself lands on its own
+// line later, from grid_login. No structural change — every caller still returns
+// { needs_auth: true }.
+const AUTH_ASK_SIGNED_OUT =
+  "How would you like to plug this?\n" +
+  "  - Sign in to your grid — it stays in your CloudGrid account.\n" +
+  "  - As a guest — live now at a link that expires in 7 days unless you claim it.\n\n" +
+  "(assistant: offer both options and let the user choose — do not choose for them. " +
+  "To sign in, call grid_login; as a guest, re-call grid_plug with anon: true. " +
+  "Stop and wait for their answer.)";
+const authAskSignedIn = (who) =>
+  `You are signed in${who}.\n\n` +
+  "How would you like to plug this?\n" +
+  "  - To your grid — it stays in your CloudGrid account.\n" +
+  "  - As a guest — live now at a link that expires in 7 days unless you claim it.\n\n" +
+  "(assistant: offer both options and let the user choose — do not choose for them. " +
+  "For their grid, re-call grid_plug; as a guest, re-call grid_plug with anon: true. " +
+  "Stop and wait for their answer.)";
+
 // ── Registration ───────────────────────────────────────────────────────────────
 // Registers the tools onto `server`. ctx.edition decides whether the CLI-wrapping
 // tools are included (they need a local machine).
@@ -117,6 +147,23 @@ export function registerTools(server, ctx) {
         _meta: { ui: { csp: WIDGET_CSP } },
       }],
     }));
+
+    // grid_login MCP App (SEP-1865). Registered via the official ext-apps
+    // helper, which defaults the MIME type to RESOURCE_MIME_TYPE
+    // (text/html;profile=mcp-app) — the type Claude web looks for. NO csp
+    // domains: the card makes no network requests of its own (it only asks the
+    // host to open the sign-in URL and calls grid_login_status back over the
+    // bridge), so deny-by-default is exactly right. Independent of
+    // APPS_WIDGETS_ENABLED by design (see constants.js).
+    registerAppResource(server, "cloudgrid-grid-login", GRID_LOGIN_APP_URI, {
+      description: "CloudGrid sign-in card — opens the sign-in URL and confirms when you return.",
+    }, async () => ({
+      contents: [{
+        uri: GRID_LOGIN_APP_URI,
+        mimeType: RESOURCE_MIME_TYPE,
+        text: GRID_LOGIN_APP_HTML,
+      }],
+    }));
   }
 
   // ── Direct-API tools (both editions) ──────────────────────────────────────
@@ -353,6 +400,13 @@ export function registerTools(server, ctx) {
       "raw entity_id. target_entity_id takes precedence. A grid+slug that does NOT resolve to an existing " +
       "entity is treated as a CREATE (never a false-positive re-plug).",
     ),
+    url: z.string().optional().describe(
+      "Alternative RE-PLUG handle: the entity's public CloudGrid URL (e.g. https://<grid>.cloudgrid.io/<slug>) " +
+      "— use it to edit in place when you have the URL but no target_entity_id (the common \"change the color of " +
+      "this page\" flow after grid_get_app_source). The grid is read from the host and the entity is resolved via " +
+      "the pickup contract, so no `grid` param is needed. target_entity_id and grid+slug take precedence. A " +
+      "non-CloudGrid host is ignored (never redirects the write); a URL that does not resolve is treated as a CREATE.",
+    ),
     hints: z.object({
       kind: z.enum(["inspiration", "app", "agent"]).optional().describe("Force the detected kind; omit to let the server auto-detect."),
       yaml: z.string().optional().describe("An inline cloudgrid.yaml override used as a detection hint."),
@@ -515,31 +569,19 @@ export function registerTools(server, ctx) {
               const claims = decodeJwtAuth(token);
               const who = claims.email ? ` as ${claims.email}` : "";
               return okResult({
-                text:
-                  `You are signed in${who}. The user has not explicitly chosen anonymous publishing. Ask the user which they want — do not choose for them:\n` +
-                  `  1. Publish to your grid (re-call grid_plug without anon: true).\n` +
-                  `  2. Publish anonymously — a guest link that expires in 7 days unless claimed (re-call grid_plug with anon: true).\n` +
-                  `Relay this question to the user and STOP until they answer.`,
+                text: authAskSignedIn(who),
                 structured: { needs_auth: true },
               });
             }
             return okResult({
-              text:
-                "This is a new publish and the user is not signed in. Ask the user which they want — do not choose for them:\n" +
-                "  1. Sign in and plug it to their grid — run grid_login (opens the browser), then re-call grid_plug.\n" +
-                "  2. Plug it as a guest — live immediately at a guest link that expires in 7 days unless claimed (re-call grid_plug with anon: true).\n" +
-                "Relay this question to the user and STOP until they answer.",
+              text: AUTH_ASK_SIGNED_OUT,
               structured: { needs_auth: true },
             });
           }
           if (!token && input?.anon !== true) {
             if (ctx.state) ctx.state.authChoiceOffered = true;
             return okResult({
-              text:
-                "This is a new publish and the user is not signed in. Ask the user which they want — do not choose for them:\n" +
-                "  1. Sign in and plug it to their grid — run grid_login (opens the browser), then re-call grid_plug.\n" +
-                "  2. Plug it as a guest — live immediately at a guest link that expires in 7 days unless claimed (re-call grid_plug with anon: true).\n" +
-                "Relay this question to the user and STOP until they answer.",
+              text: AUTH_ASK_SIGNED_OUT,
               structured: { needs_auth: true },
             });
           }
@@ -647,6 +689,14 @@ export function registerTools(server, ctx) {
         login_url: z.string().describe("URL to open in a browser to complete sign-in."),
       },
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+      // Bind the SEP-1865 sign-in card on the web edition (Claude web). This is
+      // the SEP-1865 key (_meta.ui.resourceUri); ChatGPT reads openai/outputTemplate
+      // and ignores it, and a client without the UI extension ignores it too and
+      // gets the text-first result below. NOT gated behind MCP_APPS_WIDGETS — a
+      // second, independent mechanism (see constants.js). The result shape is
+      // unchanged: content[0] stays the sign-in URL text so the link is never
+      // unreachable if the card does not render.
+      ...(ctx.edition === "web" ? { _meta: { ui: { resourceUri: GRID_LOGIN_APP_URI } } } : {}),
     },
     async () => {
       try {
@@ -660,8 +710,11 @@ export function registerTools(server, ctx) {
       if (ctx.canOpenBrowser) tryOpenBrowser(url);
       return {
         content: [{ type: "text", text:
-          `To sign in, open this URL in your browser and finish with Google:\n${url}\n\n` +
-          `After you complete it, run grid_login_status to finish signing in.`,
+          // #298: the sign-in link on its own line, unadorned, so every client
+          // linkifies it and the eye lands on it; the model-directed follow-up is
+          // quarantined in the trailing (assistant: …) line.
+          `Open this link to sign in, then finish in your browser:\n\n${url}\n\n` +
+          `(assistant: after they complete it, call grid_login_status to finish.)`,
         }],
         structuredContent: { login_url: url },
       };

package/src/web.js

@@ -57,6 +57,21 @@ function bearerOf(req) {
   return h && /^Bearer\s+\S+/i.test(h) ? h.replace(/^Bearer\s+/i, "") : null;
 }
 
+// Reduce an object to its KEY SHAPE — key names mapped to the TYPE of each value,
+// recursively — never the values themselves. Used to log the client's advertised
+// MCP capabilities at initialize (#297) while guaranteeing BY CONSTRUCTION that
+// no value ever leaves the process: only key names and JS type names are emitted,
+// so no token, header, tool argument, or user content can appear even if the
+// object carried one. Depth- and breadth-capped so a malformed or huge object
+// cannot blow the stack or flood the log.
+function keyShape(value, depth = 0) {
+  if (value === null || typeof value !== "object" || depth >= 6) return typeof value;
+  if (Array.isArray(value)) return `array[${value.length}]`;
+  const out = {};
+  for (const k of Object.keys(value).slice(0, 64)) out[k] = keyShape(value[k], depth + 1);
+  return out;
+}
+
 // A web session: identity lives in memory for the session's lifetime only. The
 // session id doubles as the stable, opaque end-user id for the trusted-server cap.
 // The identity carries the request's transport token; auth is enforced in-band by
@@ -166,6 +181,28 @@ async function buildSession(sessionId, jwt) {
     } catch {
       webCtx.state.client = null;
     }
+    // #297: record the client's advertised MCP capabilities once per session, so
+    // we can settle whether Claude web ever advertises a UI extension (e.g.
+    // io.modelcontextprotocol/ui) — the plumbing a rendered login card would
+    // need — instead of guessing while the directory submission sits unanswered.
+    // Observation-only: only the capability KEY SHAPE (names + value types, never
+    // values — see keyShape) is logged, so no credential or user content can
+    // appear. Skip the synthetic rehydrate initialize so the signal stays clean.
+    // Wrapped so a logging failure can never affect the session (zero behaviour
+    // change if capabilities is absent or malformed).
+    try {
+      const client = server.server.getClientVersion() ?? null;
+      if (client?.name !== "cloudgrid-mcp-rehydrate") {
+        const caps = server.server.getClientCapabilities();
+        const shape = caps && typeof caps === "object" ? keyShape(caps) : null;
+        // eslint-disable-next-line no-console
+        console.error(
+          `cloudgrid-mcp: client-capabilities client=${client?.name ?? "unknown"} capabilities=${JSON.stringify(shape)}`,
+        );
+      }
+    } catch {
+      /* observation-only — never affects the session */
+    }
   };
   await server.connect(transport);
   return { transport, identity };

package/src/widgets/grid-login/mcp-app.css

@@ -0,0 +1,57 @@
+:root { color-scheme: light dark; }
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  font-family: var(--font-sans, Inter, system-ui, -apple-system, sans-serif);
+  background: transparent;
+  color: light-dark(#0d0d0f, #fafafa);
+}
+#card {
+  max-width: 420px;
+  margin: 0 auto;
+  padding: 1.5rem;
+}
+h1 {
+  font-size: 1.15rem;
+  margin: 0 0 0.5rem;
+}
+.lede {
+  margin: 0 0 1rem;
+  font-size: 0.9rem;
+  line-height: 1.45;
+  opacity: 0.85;
+}
+.status {
+  margin: 0 0 1rem;
+  font-size: 0.85rem;
+  opacity: 0.7;
+  min-height: 1.2em;
+}
+.actions {
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+button {
+  font: inherit;
+  font-weight: 600;
+  padding: 0.6rem 1.1rem;
+  border-radius: 8px;
+  border: 1px solid transparent;
+  cursor: pointer;
+  background: light-dark(#0d0d0f, #fafafa);
+  color: light-dark(#fafafa, #0d0d0f);
+}
+button:disabled { opacity: 0.5; cursor: default; }
+button.secondary {
+  background: transparent;
+  color: inherit;
+  border-color: light-dark(rgba(13,13,15,0.25), rgba(250,250,250,0.3));
+}
+.fallback {
+  margin: 1rem 0 0;
+  font-size: 0.8rem;
+  opacity: 0.7;
+  word-break: break-all;
+}
+.fallback a { color: inherit; }

package/src/widgets/grid-login/mcp-app.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<title>Sign in to CloudGrid</title>
+<style>/* __CSS__ */</style>
+</head>
+<body>
+<main id="card">
+  <h1>Sign in to CloudGrid</h1>
+  <p class="lede">CloudGrid runs your apps with the infrastructure they need. Sign in to plug to your grid.</p>
+  <p class="status" id="status">Preparing the sign-in link.</p>
+  <div class="actions">
+    <button id="signin" type="button" disabled>Open sign-in</button>
+    <button id="check" type="button" class="secondary" hidden>Check sign-in</button>
+  </div>
+  <p class="fallback" id="fallback" hidden>
+    Or open this link yourself:
+    <a id="fallback-url" href="#" target="_blank" rel="noopener noreferrer"></a>
+  </p>
+</main>
+<script type="module">/* __JS__ */</script>
+</body>
+</html>